General

  • Target

    file.exe

  • Size

    3.1MB

  • Sample

    241207-vlpvbsxkat

  • MD5

    5cc43c13e14113d07197871708ba3d6a

  • SHA1

    3fd30c8b2df49f949086aa654ca67e67bc963a08

  • SHA256

    e147291b4b3f7e51599ff3e03f07cc2f556d35d7a0fa1c8ed284498ca6efc7f2

  • SHA512

    515ca57618a4e09eaafe432e8a345f712d29488b97cc3b88299179694c1facb0a61c5bbc019e14481ee6b2258b531a0d5d4eff9ae187404e01451ed12ef5bb02

  • SSDEEP

    49152:rvlYcKpLjavBk95yL7Po+Yamr9EuBlKJUqq/yNXlxwPw:rv6vgv295yL7Po+w9EuBIuqr5w

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

amadey

Version

5.04

Botnet

397a17

C2

http://89.110.69.103

http://94.156.177.33

Attributes
  • install_dir

    0efeaab28d

  • install_file

    Gxtuum.exe

  • strings_key

    6dea7a0890c1d404d1b67c90aea6ece4

  • url_paths

    /Lv2D7fGdopb/index.php

    /b9kdj3s3C0/index.php

rc4.plain
1
eae06a1a5e3a21343b11fa0f4223ae43

Extracted

Family

lumma

C2

https://impend-differ.biz/api

https://print-vexer.biz/api

https://dare-curbys.biz/api

https://covery-mover.biz/api

https://formy-spill.biz/api

https://dwell-exclaim.biz/api

https://zinc-sneark.biz/api

https://se-blurry.biz/api

https://atten-supporse.biz/api

https://infect-crackle.cyou/api

Extracted

Family

stealc

Botnet

stok

C2

http://185.215.113.206

Attributes
  • url_path

    /c4becf79229cb002.php

Extracted

Family

lumma

C2

https://atten-supporse.biz/api

https://se-blurry.biz/api

https://zinc-sneark.biz/api

https://infect-crackle.cyou/api

Targets

    • Target

      file.exe

    • Size

      3.1MB

    • MD5

      5cc43c13e14113d07197871708ba3d6a

    • SHA1

      3fd30c8b2df49f949086aa654ca67e67bc963a08

    • SHA256

      e147291b4b3f7e51599ff3e03f07cc2f556d35d7a0fa1c8ed284498ca6efc7f2

    • SHA512

      515ca57618a4e09eaafe432e8a345f712d29488b97cc3b88299179694c1facb0a61c5bbc019e14481ee6b2258b531a0d5d4eff9ae187404e01451ed12ef5bb02

    • SSDEEP

      49152:rvlYcKpLjavBk95yL7Po+Yamr9EuBlKJUqq/yNXlxwPw:rv6vgv295yL7Po+w9EuBIuqr5w

    • Amadey

      Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    • Amadey family

    • Lumma Stealer, LummaC

      Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    • Lumma family

    • Modifies Windows Defender Real-time Protection settings

    • Stealc

      Stealc is an infostealer written in C++.

    • Stealc family

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    • Downloads MZ/PE file

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.